typosquatting

basicwidespread

A type of fraud where the attacker registers a misspelled version of a known web address or software package name to lure inattentive users.

In plain terms

Imagine that someone opens a shop next to your favorite bakery with almost the same name, only one letter is different on the sign. Whoever is in a hurry and does not look closely buys from them. Typosquatting is the same on the internet: the fraudster counts on you making a typo or not noticing the small difference.

The classic version works with web addresses: on a mistyped address of your bank or an online store, a deceptively similar page awaits, asking for your password or card details. The other version, now at least as important, targets programmers: malicious packages with names similar to popular software packages are uploaded to public repositories.

In the AI era, the situation has taken a new turn. Coding agents can just as easily misspell or mix up a package name as a human, and if installed without human oversight, a malicious package can enter the system unnoticed. A related trick is slopsquatting: language models sometimes invent non-existent package names, which attackers then reserve in advance.

Unlike most attacks, this one does not break anything; it simply waits for you or your machine to make a mistake.

How it works

The attacker selects a name widely used by many: the address of a bank or online store, or a popular software package.
It reserves misleading variations of the name: missing or swapped letters, similar characters (for example, 1 instead of l), different endings (.co instead of .com), and misplaced hyphens.
At a fake address, it builds a site resembling the original, or it hides malicious code in a fake package that often performs the original function too, so it goes unnoticed.
It waits until someone types in a name, clicks a deceptive link, or an AI-agent mistakenly installs the fake package.
The loot is a password, bank card data, access key, or control over an infected machine, which the attacker transfers or uses for further attacks.

An everyday example

You hastily type the address of your online banking and miss a letter. The page looks exactly like the real one, asks for your ID and password, but your data ends up with scammers. The same happens when a developer or a coding agent installs a package named "reqeusts" instead of "requests".

Who is affected

everyoneAnyone can mistype a letter in the browser or click a link that only looks familiar at first glance.

bank customer, investorBanks and investment service providers are among the most frequently cloned sites because login credentials can lead directly to money. → Money

developerA single misspelled package name in the installation command can introduce malicious code to your machine and the entire product, especially if a coding agent installs it for you. → Code

entrepreneur, executiveA fake address similar to your company's name can deceive both your customers and employees, costing money and trust.

A common misconception

MythIf the browser shows a padlock next to the address, I am definitely on the real site.

In realityThe padlock (or the https at the start of the address) only indicates that the connection is encrypted, not that the site belongs to who you think it does. Most fake sites now also use encrypted connections. Partly for this reason, Chrome replaced the padlock icon with a neutral symbol in 2023.

Limits and risks

A fake site or package is often a perfect copy, so appearance proves nothing: always verify the exact name.
A company cannot register every misspelled variation of its name, so protection is never complete.
An AI assistant's suggested package name or link can also be wrong or fabricated; check it before installation or clicking.
Open important pages (banking, government services, email) from bookmarks or the official app, not by typing the URL or clicking links received via email.

Similar, but not the same

phishing – Phishing actively seeks you out (via email, SMS, or call), while typosquatting waits silently for your mistake; the two are often combined.
slopsquatting – Here, attacks are built not on human typos but on AI-invented, non-existent package names that the attacker reserves in advance.
cybersquatting – Cybersquatting is the broader term: the bad-faith registration of a domain name tied to another brand or name for profit. Typosquatting is a specific type that relies explicitly on misspelled variations.

Related concepts

Broader

cybersecurity, cybersquatting, supply chain attack, deception-based attack

Narrower

typosquatting fraud, package name typosquatting attack

On the edge

slopsquatting, phishing, hallucination, malicious software, coding agent

A brief history

The phenomenon emerged with the mass spread of web addresses in the 1990s; in the United States, a specific law (Anticybersquatting Consumer Protection Act) was enacted in 1999 against bad-faith domain registration. Since the second half of the 2010s, it has also become common in open-source package repositories.

Where things stand

As of late 2026, it is an everyday attack method on the web and in software package repositories. The spread of coding agents has given it new momentum, because agents can install a wrongly named package without human review.

Status: 2026 November

Also known as

typosquatting · typo-squatting · typo squatting · URL hijacking · typo-based fraud · typosquatting domain registration · package typosquatting

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.